Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

Filter by
Sorted by
Tagged with
1
vote
0answers
32 views

Suspicious Android app - install on its own - no uninstall option - name in Japanese [on hold]

I recently saw the app below in my phone. Have disabled it immediately when I saw it. Have no idea: what it is why it's in my phone how long it's been there and how to uninstall it (there's no ...
0
votes
0answers
55 views

Computer infected with malware or false positive? [on hold]

(windows 8.1 user) A few months ago I downloaded binaries from: https://github.com/noahp/srlua-mingw They had 2 exe files in the folder: srlua.exe and glue.exe. I had been unable to compile srlua ...
0
votes
2answers
79 views

Can a PowerShell script inside a Zip file execute automatically upon unzipping?

I have a zip file that has a Powershell script inside that I want to look at. Is it possible that the Powershell script could execute automatically just by unzipping the file? This is not something I ...
1
vote
1answer
71 views

Virus from a printer kiosk?

I encountered a puzzling situation the other day when I plugged in a USB flash drive. Windows defender displayed an alert saying that a threat had been quarantined, specifically the Jenxcus VBS virus. ...
0
votes
1answer
105 views

Consequence of BadUSB and laptops?

Are internal components vulnerable to BadUSB? Say you have a laptop. Even if you don't use any USB devices (like mice and keyboard), if the laptop has internal components that connect through USB (...
-1
votes
1answer
42 views

Does the term “malware signature” always refer to a pattern of bytes? [duplicate]

I know that traditionally a malware signature is a pattern of bytes in a program. While reading Joxean Koret and Elias Bachaalany's "Antivirus Hacker's Handbook" I saw that the authors categorized the ...
-7
votes
1answer
204 views

Honeypot for hunting browser zero-days, rootkits and malware [closed]

I would like to create a honeypot (bot) to hunt browser zero-days (and browser extensions). What is the best way to find those 0days automatically (I would like to create a sandboxed bot which would ...
0
votes
0answers
42 views

Hacking iOS 12.4 using code for iOS 12.2

In the original iOS 12.4, Apple accidentally unpatched a bug that allows for a remote hack when paired with a browser exploit. This bug could exploit iOS 12.2, and was patched in iOS 12.3. If ...
65
votes
7answers
17k views

How to investigate an unknown 1.5GB file named “sudo” in my Linux home directory?

I found a file in my home directory named "sudo". It's 1.5GB in size and I have no idea where it came from. -rw-r--r-- 1 foo foo 1598296064 Aug 9 11:22 sudo Does anybody have any tips on how to ...
2
votes
1answer
108 views

Would it be possible for me to become infected just by opening a Facebook message?

I received one of those obvious fake "is this you?" and some fake Youtube link on Facebook Messenger. I don't know what it redirected to as I didn't click it (I only hovered over it to see if it was a ...
0
votes
0answers
15 views

Steganography/Encryption [duplicate]

How would you know if an image you opened contained a malicious file? Does anyone know the signs of your phone being infected with it and how are you suppose to get rid of a virus like that?
2
votes
2answers
222 views

SD card planted in my pocket

Today, I found a SD card in my pocket. I've never seen it before and am nearly certain I didn't put it there myself. My suspicion is that someone stealthily planted it there while I was walking ...
0
votes
4answers
213 views

Does safe removable media exist?

I have a laptop operating a vehicle with attached camera. Video is exported using removable media. Ports available are USB and Ethernet (also video and audio I suppose). The laptop is not infected (...
0
votes
1answer
65 views

Attacking several browser/OS combinations with only one link

I’m relatively new to this topic so forgive what may be an obvious lack of understanding. Say that an attacker had a malicious website whose objective was to plant a Trojan into the device of the ...
1
vote
0answers
49 views

Identification of Unknown Potential MITM/Malware involving SSL Connections

On my server one of the services is a Discord bot. It was down which prompted me to look into why. In my syslogs I noticed three increasingly concerning items: do-agent[1066]: 2019/08/25 08:50:21 ...
0
votes
0answers
63 views

Can phone apps edit my clipboard?

This is a question similar to this one but it is all about editing the clipboard contents. Can phone apps read my clipboard? Is this actually a case on latest API of Android an iOS? I mean ...
0
votes
0answers
21 views

Is there any anti-virus that only uses behaviour-based malware detection? [duplicate]

I would like to know any antivirus software that uses strictly only a behaviour-based malware detection technique as the aim of my research is to compare behavioural-based and signature-based malware ...
0
votes
2answers
102 views

how common is it for an antivirus program to give false positive?

Often antivirus programs trigger a false alarm that a certain file is corrupted or infected. My question is that how common is that and if it is too common, can we really rely on them. Along with ...
0
votes
1answer
74 views

If device is infected, can new devices get malware from associated social media accounts?

I have a couple social media accounts i want to use on a new phone ive got. The old phone i believe is infected with deep-malware. If I switch 2fa to my new phone which uses the same number but ...
1
vote
2answers
89 views

Is there a standard way to check if a requirements.txt has potential security issues? [closed]

Every open code repository has security issues. Attackers can use three ways to sneak malware in: Abuse typos: Create a package with a similar name, but the package is malware Malware + useful code: ...
0
votes
0answers
36 views

Help with malware on removable drives

Here's the situation. So, I was recently the victim of a drive-by download. The first thing I did was shut off my laptop, thinking that would stop it. When I turned it back on, there was a suspicious ...
1
vote
1answer
133 views

Mindlessly clicked days old phishing email link appeared dead

Was multitasking and mindlessly clicked Squarespace phishing email. Page didn't load, and right away I realized my mistake. Completed several malware scans which came back clean. The button link ...
1
vote
1answer
120 views

Malicious 'specially crafted' MP4 file [closed]

I came across CVE-2019-2107 that says ".... With CVE-2019-2107 the decoder/codec runs under mediacodec user and with properly "crafted" video (with tiles enabled - ps_pps->...
-2
votes
1answer
142 views

How can I check for a virus and malware on a USB drive using Ubuntu? [closed]

If I plug in a USB drive in to an Ubuntu (18) machine, is it possible to get a virus? How can I see if a (Windows, Mac or other) virus is on it? How can I format it to remove any virus?
4
votes
0answers
39 views

What is the most efficient approach to automate testing a malware sample on many different AVs without using online services? [closed]

So let's say you want to automate changing parts of malware and testing it on many different AVs, and you want all this process to be automated, i believe people who gave the AVLeak talk in black hat ...
0
votes
1answer
64 views

WPAD (badWPAD vulnerability) should I disable or not?

Hi I have read recently very bad things about WPAD vulnerability for example here nakedsecurity.sophos.com/2016/05/25/when-domain-names-attack-the-wpad-name-collision-vulnerability/ (article from ...
1
vote
0answers
55 views

Can malware in Android persist after reformatting/reinstalling?

Something similar to this happened to me recently. According to the suggested actions in the post: Do take the device into the dealer and make them explain what those messages are. If they can'...
0
votes
1answer
91 views

Analyze Windows Malware on Linux

I'm just getting started with the book 'Practical Malware Analysis', some of the exercises are using PEview and Dependency Walker however I'm slightly allergic to using Windows. Is it possible to ...
0
votes
1answer
67 views

malware stream my phone activities to attacker [duplicate]

I have a rooted android phone and I know there's a malware in the phone . The malware is capable of automatically connect to a nearby bluetooth device or wifi ap and stream whatever I do on the phone ...
0
votes
3answers
93 views

Is it safe to backup programming projects from a possibly infected computer?

Is is safe to backup programming projects (for example websites that where made using HTML/CSS/JS with the help of some frameworks and libraries (Bootstrap, jQuery, etc.), C# projects made with the ....
0
votes
0answers
46 views

I’ve been scammed! Fake Microsoft tech services [duplicate]

I was under the assumption that my IP address was hacked last night because of this movie website I was on. Thanks to the good people of “stackexchange.com”, I learned that they tried to con me by ...
-2
votes
1answer
117 views

My IP address was hacked by Trojan Tiny Banker

I was using a unsecured website to watch movies and my windows 10 alert went off saying my registration code had been blocked or something to that nature and to call1(888)2521262 .. tech support.. ...
0
votes
1answer
101 views

How do AVs scan the file in websites that claim they don't send the files to AVs like Nodistribute.com? [closed]

So for example one of the famous alternatives to Virustotal aka Nodistribute.com claims that it doesn't send the file to AVs, but if it doesn't, then how can they scan it? just by checking the hash? ...
1
vote
1answer
92 views

Can Android 5's own device encryption mechanism be exploited by a malware?

My wife's phone can't boot into android and instead displays a message that encryption has failed and all data is lost. She did not start the encryption process by herself. Now my question is: can ...
0
votes
2answers
186 views

Could clicking a Grabify link to my Facebook page get me hacked?

My newest boyfriend sent me a Grabify link on Messenger. Without thinking (probably because of trusting him), I clicked the link (yeah, I'm an idiot, lol). The link has routed to my Facebook account. ...
0
votes
1answer
77 views

What is “rule-based” analysis in malware detection?

I've read a few articles that describe the heuristic detection used by AVs as being either "weight-based" or "rule-based". The weight-based aspect seems to make sense, but I don't understand what "...
2
votes
3answers
197 views

Is it safe to backup data (images, documents, videos, etc…) from a possibly infected computer?

If I had a possibily infected computer, where I had some images and documents that I wanted do backup to a thumb drive, is it possible that that the used thumb drive could be infected and when ...
1
vote
1answer
69 views

Unknown manufacturer of services in windows system configuration

I would like to ask if I can trust unknown manufacturer detected by windows system configuration. As you can see in the screenshot, all of the other services is known manufacturer but there is one ...
0
votes
1answer
125 views

What does “packed file” mean in security?

I am a beginner in information security. I was clueless about the term "packed file". Can anyone explain to me what a "packed file" is in term of malware analysis?
1
vote
1answer
139 views

Folders with .js files that I didnt create are in my pictures directory windows 10, virus?

About a month ago, two folders appeared in my /pictures directory named: Ready To Glare 🔪 (@ReadytoglareYT) _ Twitter_files and Lawrence's stream mom _ funhaus_files . Inside the folders are .js....
0
votes
0answers
21 views

Can any malware survive disk formatting and removing all partitions before reinstalling the OS? [duplicate]

Can any malware survive disk formatting and removing all partitions before reinstalling the OS? If that is the case, then what can one do to be certain of having cleared all malware from his pc?
0
votes
2answers
214 views

How can I check a .srt and .txt file for malware?

I recently downloaded subtitles for an episode of a series. I then looked at whether .srt files could contain a virus and found that that was indeed the case with some .srt files which exploited a ...
0
votes
2answers
237 views

Should you really check user uploaded files for malware/shells?

It's clear that the system has to filter user input. I always thought that the standard is also to check user uploaded files for malware/shells. I'm curious if above is really needed. There is a PHP (...
1
vote
1answer
113 views

How much protection does sandbox software provide against malicious .exe?

I need to review a large number of .exe game files. I recently had an incident where I got infected by an .exe that passed all my 'checks': virus scan, Virustotal, reviews, community feedback, ...
1
vote
1answer
149 views

My production Ubuntu server was breached through Redis and I found this script. Is it a decoy?

A few days ago my VPS came under heavy load from spammers trying ssh attacks and script injections. I have since added new fail2ban regexps and new security measures for REDIS where it looks like they ...
0
votes
0answers
44 views

Are all “behavioral detection” of malware a form of heuristic detection? [duplicate]

A lot of articles I read seem to lump behavioral detection together with heuristic detection. From what I know, one of the defining features of heuristic detection is that it can be used to detect new ...
0
votes
0answers
81 views

New user has appeared on my Macbook Pro [duplicate]

Today I noticed the addition of a new user "Linchengzhang" on my MacBook pro. Apparently the user was added 25th April 2019 (according to the folder creation) and it appears to have an identical ...
2
votes
1answer
106 views

Can the conversion of a malicious PDF to image be exploitable?

Let's say I want to allow to the customer's of my website to upload PDF documents. What would be more safe to do: Convert the PDF to image using a library and store it in my file server as an image? ...
-1
votes
1answer
40 views

Java web app hosted in tomcat hanged for more than 10 min with logs containing powershell attack

We have a java web application running in tomcat which is hosted in AWS. The operating system used in the server is Centos. Today it become inaccessible for more than 10 minutes. When we got access, ...
20
votes
2answers
4k views

At which point can a system be compromised when downloading archived data from an untrusted source?

If I download archived data from a possibly untrusted source at which point am I at possible risk of harming my system: Initially downloading and saving the archived data (still packed) Unpacking the ...